test(dev): seed an inbound HTML conversation to exercise the UI sanitizer path

[zaridan]

What

Adds one inbound-only seeded conversation to the dev API harness (src/dev/seed.ts) whose thread carries a realistic bodyHtml — formatting, a link, a remote <img> (tracking pixel), and a <script> — alongside its bodyText.

Why

The seed previously held only plain-text bodies. The Agent Inbox UI renders inbound bodyHtml through DOMPurify (spec §5's stored-XSS contract), but with no HTML in the seed the sanitizer path was never exercised against real data in local dev. The design prototype's mock deliberately seeded an inbound <script>document.title="pwned"</script> + tracking-pixel <img> for exactly this reason; this restores that coverage in the engine's own dev seed so the UI's sanitized-HTML band, its HTML email · sanitized · external images blocked caption, and the Show-original modal all have real data to render.

Shape

• Modeled on fixtures/mail/observed/html-body.json and spec §5 (specs/api/agent-inbox-v1.md): the store returns untrusted inbound HTML verbatim; sanitization is the renderer's job.
• Inbound-only (no reply), so it adds a conversation without perturbing the delivery-state distribution (sent/failed/pending) the test asserts.
• Scope held to the dev seed only (src/dev/seed.ts + src/dev/seed.test.ts), per the task.

Verification

• src/dev/seed.test.ts updated (count 6→7, open 5→6) with a focused assertion that the HTML thread stores bodyHtml verbatim (strong / link / img / script) alongside bodyText. ✅
• Full suite: 397 passed. Typecheck + biome clean. ✅
• Booted npm run dev:api and confirmed the live API serves the HTML body verbatim (script/img/link/formatting intact) next to bodyText. ✅

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added a seeded demo conversation containing rich HTML content, including links, images, and scripts, to support inbox rendering and sanitization scenarios.

• Tests

  • Updated development seed expectations for the additional conversation.
  • Added coverage verifying inbound HTML content, plain text, and key markup are stored correctly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7dadd04c-2eb2-4751-94c5-6b917532ae9f

📥 Commits

Reviewing files that changed from the base of the PR and between b70fc79 and dca6f5f.

📒 Files selected for processing (2)

• src/dev/seed.test.ts
• src/dev/seed.ts

---

📝 Walkthrough

Walkthrough

The development seed now creates a seventh inbound-only conversation with plain-text and rich HTML content, including links, an image, and a script tag. Tests update conversation counts and verify the stored HTML payload and message attributes.

Changes

Rich HTML development seed

Layer / File(s)	Summary
Add inbound rich HTML scenario src/dev/seed.ts	The seed documentation and implementation add an inbound-only conversation with bodyText and rich bodyHtml content, incrementing the conversation count.
Update seed expectations and assertions src/dev/seed.test.ts	Tests expect seven conversations, six open conversations, unchanged send counts, and verify the inbound message’s stored HTML fields and markup.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Helpthread/helpthread#23: Both changes update the development seed scenarios and conversation-count tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: seeding an inbound HTML conversation to exercise sanitization behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/ht-seed-html-body

---

_{Comment @coderabbitai help to get the list of available commands.}